ok, so far i can see it is running a 2.4 kernel....are there any GPL sources available for this box (or a similar box) ? it might be helpfull for replacing the kernel with some additional kernel modules

by looking at http://www.uv.es/cuan/arxius/FT3563-BT/mtd1.bin with my hex editor i noticed
1) at beginning there were some strings that looked like as if they were from a bootloader? "Uncompressing Linux"....maybe this is a "daisy chained" bootloader..a bootloader thats loaded from another bootloader...
2) i noticed the word "ramdisk" inside.....probably after the kernel in the file. somehow i believe that you already were able to extract the ramdisk as i noticed this file: http://www.uv.es/cuan/arxius/FT3563-BT/ ... les.tar.gz
if yes then please post how exactly you extracted the tarball.....so others can check themselves and to document it for yourself...you will need it to reassemble it.

Hi. Thanks for your reply.
I can't found any GPL and kernel sources for this device. No JTAG or serial description on the web.

mindbender wrote:ok, so far i can see it is running a 2.4 kernel....are there any GPL sources available for this box (or a similar box) ? it might be helpfull for replacing the kernel with some additional kernel modules

by looking at http://www.uv.es/cuan/arxius/FT3563-BT/mtd1.bin with my hex editor i noticed
1) at beginning there were some strings that looked like as if they were from a bootloader? "Uncompressing Linux"....maybe this is a "daisy chained" bootloader..a bootloader thats loaded from another bootloader...
2) i noticed the word "ramdisk" inside.....probably after the kernel in the file. somehow i believe that you already were able to extract the ramdisk as i noticed this file: http://www.uv.es/cuan/arxius/FT3563-BT/ ... les.tar.gz
if yes then please post how exactly you extracted the tarball.....so others can check themselves and to document it for yourself...you will need it to reassemble it.

Thanks for the tests.
I extracted ramdisk finding hexadecimal 1F8B0808 (begining of ramdisk).

busybox/tinylogin for many things
lpd for printserver
samba for filesharing
bittornado for torrent-downloading
bftpd for ftp-serving
thttpd for web-serving

the hdd seems to be formated with XFS and i expect the libc to be version 2.3.2 and interestingly it seems to support python and there is the libflash library?

Yes, hdd are formated with XFS, and ramdisk (/dev/ram0) are formated ext2.
It suports python, because use bittornado client.
System has 32MB RAM, and use 16MB to Ramdisk. This will reduce to 16MB all RAM available for:
samba+thttp+ftp+bittornado...!!!!
My first goal are to change root to a harddisk partition (and free ram) using pivot_root (I try adapt init from http://wiki.dns323.info/howto:install_debian), but does'nt work.

mindbender wrote:
whatever....most important is to document how to disassemble and reassemble the file, document this. also document how you are able to execute something as root over the webinterface.

and....i do not know if you noticed....but there is /usr/sbin/telnetd ...... try to start the telnet daemon.

mindbender wrote:i just requested the GPL sources for several different boxes/vendors via their web forms.

we will see if someone gives provides them. From the legal point they have to but you never know.
When i get them i will put them to http://gpl.nas-central.org and notify you.

it does not seem to be important who actually provides them as they all look very similar.

10 or 15 days ago, I mailed to fully-top, but no response.
I say, what they not agree GPL license.

mindbender wrote:
regarding disassembling and reassembling the firmware again: "dd" is the right tool to use. a small script which is able to disassemble and assemble later again would be best.

Yes, i use dd. I'm capable to determine ramdisk begining, but no where linux Image begins.
Ramdisk begins at position x15acf4 of mtd1, and I suppose what kernel image will go from 0 to x15acf4 (except boot)

mindbender wrote:
regarding serial: no obvious serial port with 4 pins....it seems to be something else. i haven`t found anything on the net so far....looks like trial and error then.

I test JP1 using a max233 cable, but this IC works at 5V, and no positive results.
I'm waiting for a max3232 cable what works at 3,3V.
I supose what JP1 will be serial because this connector has 2 pins to low (can be RX and CTS), and a JTAG only have one pin to low (TDO). A user from(30252783) a italian forum says me this.
Thanks.
PS:mindbender, have you any of these cheap NAS?

i got feedback from the multicase guys. they told me that they were not aware of the fact that their box runs linux and they will now organise the GPL source package for the NS-348S....i also checked the downloadable firmwares for the NS-347 & NS-347S , the same...so i requested them for all 3 boxes.

will take a while, but i know that multicase complied to the GPL before ....the Dualhddnas devices.

i suppose we will have GPL sources soon then.

@serial: yes, so far i have only encountered 3.3V in all NAS devices i have (only buffalo boxes...this also answers your last question).

I've just (as in today) taken delivery of an NCB3AS (marketed under the Evertech brand here in Europe) that shares the same firmware as the NCB3AHT.
I had a look through the firmware upgrade .bin file, and can confirm that it's linux based, so I've requested source from Age Star.

I have zero experience in NAS hacking, and mainly casual user experience in Linux (but many years coding experience), but let me know if I can be of any help.

Lissajous wrote:I've just (as in today) taken delivery of an NCB3AS (marketed under the Evertech brand here in Europe) that shares the same firmware as the NCB3AHT.
I had a look through the firmware upgrade .bin file, and can confirm that it's linux based, so I've requested source from Age Star.

I have zero experience in NAS hacking, and mainly casual user experience in Linux (but many years coding experience), but let me know if I can be of any help.

Hi Lissajous, thanks for your offering, please, read this post:http://www.lliures.org/2008/05/02/ft3563-bt-hacking/ or at first post of http://tech.groups.yahoo.com/group/FT3563-BT/
and try to exec something like ls, and try to execute dmesg and post output here to compare devices. (you need linux to do this, Ubuntu are a easy Linux distribution)
If are possible, open your box and take some pictures and determine IC's to compare devices.
I also have zero experience in NAS (or other device) hacking.
You can post any doubt here.

Yes, that is I want say.
And, a interesting(an trivial) thing to put, should be what you can put a arm compiled executable at same partition of init_telnet.sh, and execute it (ie:if no telnetd available)
Before I discover what telnetd exists, I use netcat for arm.